Den1Al

A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the `core:themes:create` permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

An OS command injection flaw exists in the `internal/gitcmd` component of DeepSeek-Reasonix (Reasonix Studio). A local attacker who controls repository content, specifically the `.gitattributes` and `.git/config` files, can execute arbitrary commands through the desktop application's workspace-changes diff viewer. The issue occurs because the tool fails to restrict the Git clean filter, allowing a malicious repository configuration to define a filter containing attacker-controlled commands that are executed when a developer opens a file diff. Delivery of the malicious configuration typically requires mechanisms such as repository archives, synced folders, CI caches, or devcontainer builds, as standard HTTPS or SSH clones do not transfer the `.git/config` file. Additionally, a compromised or prompt-injected AI agent already running on a workstation could potentially write the poisoned configuration directly.

A remote code execution issue exists when `require.external` is enabled without an explicit `require.root` that excludes `node modules`. This allows sandboxed code to require the vm2 package itself, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands using `child process`.